Dear All, I'm using an HP ProCurve MSM 710 as the NAS, and SQL for accounting and authentication. Simultaneous-Use works sometimes, but not all the time.
From what I've read, for the NAS-type 'other', freeradius only queries radutmp, and does no additional checkrad check. Obviously I would like to change that. Could someone tell me please where I can make the necessary changes? so I can add a checkrad routine for 'other' nas-type, and change that routine according to my needs.
I would also like to point out that radwho only works if I specify the file, via "radwho -F /var/log/freeradius/sradutmp". So if checkrad wraps around radwho, like radzap, this might be an issue. Here's my sites-available/default file, if anyone is interested in that: https://termbin.com/334u Thanks for any and all help! Kind Regards, Taymour
hi, as per the clients.con # The nas_type tells 'checkrad.pl' which NAS-specific method to # use to query the NAS for simultaneous use. this is actually checkrad - which should end up in sbin/ - very few additional NAS types have been added over the years - but you can check that script to see how it deals with eg cisco and maybe copy that method? alan On Fri, 5 Jul 2019 at 19:17, Taymour Gabr via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Dear All,
I'm using an HP ProCurve MSM 710 as the NAS, and SQL for accounting and authentication. Simultaneous-Use works sometimes, but not all the time.
From what I've read, for the NAS-type 'other', freeradius only queries radutmp, and does no additional checkrad check. Obviously I would like to change that. Could someone tell me please where I can make the necessary changes? so I can add a checkrad routine for 'other' nas-type, and change that routine according to my needs.
I would also like to point out that radwho only works if I specify the file, via "radwho -F /var/log/freeradius/sradutmp". So if checkrad wraps around radwho, like radzap, this might be an issue.
Here's my sites-available/default file, if anyone is interested in that: https://termbin.com/334u
Thanks for any and all help! Kind Regards, Taymour - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, Thanks Alan, I'm confused however how checkrad can help with any simultaneous use that isn't set to exactly '1'. checkrad has this notice at the top # Returns: 0 = no duplicate, 1 = duplicate, >1 = error. So if checkrad is called when radwho would deny the user, and my simultaneous-use is set to 3. I would want it to return 0 if that user is logged in less than 3 times. That in turn means, I have to hard-code checkrad to include a method for my it for my nas to return 0, if it finds less than 3 users. The number 3 would be hard-coded. This doesn't seem right. Am I missing something? Thanks again for the help Kind Regards, Taymour On 05/07/2019, Alan Buxey <alan.buxey@gmail.com> wrote:
hi,
as per the clients.con
# The nas_type tells 'checkrad.pl' which NAS-specific method to # use to query the NAS for simultaneous use.
this is actually checkrad - which should end up in sbin/ - very few additional NAS types have been added over the years - but you can check that script to see how it deals with eg cisco and maybe copy that method?
alan
On Fri, 5 Jul 2019 at 19:17, Taymour Gabr via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Dear All,
I'm using an HP ProCurve MSM 710 as the NAS, and SQL for accounting and authentication. Simultaneous-Use works sometimes, but not all the time.
From what I've read, for the NAS-type 'other', freeradius only queries radutmp, and does no additional checkrad check. Obviously I would like to change that. Could someone tell me please where I can make the necessary changes? so I can add a checkrad routine for 'other' nas-type, and change that routine according to my needs.
I would also like to point out that radwho only works if I specify the file, via "radwho -F /var/log/freeradius/sradutmp". So if checkrad wraps around radwho, like radzap, this might be an issue.
Here's my sites-available/default file, if anyone is interested in that: https://termbin.com/334u
Thanks for any and all help! Kind Regards, Taymour - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 5, 2019, at 10:53 PM, Taymour Gabr via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I'm confused however how checkrad can help with any simultaneous use that isn't set to exactly '1'. checkrad has this notice at the top # Returns: 0 = no duplicate, 1 = duplicate, >1 = error.
So if checkrad is called when radwho would deny the user, and my simultaneous-use is set to 3. I would want it to return 0 if that user is logged in less than 3 times. That in turn means, I have to hard-code checkrad to include a method for my it for my nas to return 0, if it finds less than 3 users. The number 3 would be hard-coded.
This doesn't seem right. Am I missing something?
"checkrad" hasn't really been of great use for many years. Most modern NASes are good enough that they don't lose accounting packets that often. In short: If cehckrad works, great. If it doesn't work, they may be a lot of effort to fix it. Alan DeKok.
Thanks, this doesn't answer my question though of how/if checkrad works for simultaneous-use set to anything other than 1. Also, could you please expand on what you consider to be 'modern' NASes? 2 years-old, 5 years-old, 10? We are looking to replace our crappy HP controller. Unfortunately HP was taken over by Aruba, and their controllers don't support HP Access points. So we are trying to go with the latest HP controller, and I would like to make sure that simultaneous-use will be covered. Thanks, Taymour On 06/07/2019, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 5, 2019, at 10:53 PM, Taymour Gabr via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I'm confused however how checkrad can help with any simultaneous use that isn't set to exactly '1'. checkrad has this notice at the top # Returns: 0 = no duplicate, 1 = duplicate, >1 = error.
So if checkrad is called when radwho would deny the user, and my simultaneous-use is set to 3. I would want it to return 0 if that user is logged in less than 3 times. That in turn means, I have to hard-code checkrad to include a method for my it for my nas to return 0, if it finds less than 3 users. The number 3 would be hard-coded.
This doesn't seem right. Am I missing something?
"checkrad" hasn't really been of great use for many years. Most modern NASes are good enough that they don't lose accounting packets that often.
In short: If cehckrad works, great. If it doesn't work, they may be a lot of effort to fix it.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jul 7, 2019, at 8:49 PM, Taymour Gabr via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
this doesn't answer my question though of how/if checkrad works for simultaneous-use set to anything other than 1.
Checkrad is run once for every user session. But that means it has to check *each* user session.
Also, could you please expand on what you consider to be 'modern' NASes? 2 years-old, 5 years-old, 10?
Realistically, 10 years. Checkrad is ~20 years old, and hasn't been updated in a very long time.
We are looking to replace our crappy HP controller. Unfortunately HP was taken over by Aruba, and their controllers don't support HP Access points. So we are trying to go with the latest HP controller, and I would like to make sure that simultaneous-use will be covered.
At this point, the NASes should work better. Checkrad is less useful. Alan DeKok.
On Jul 7, 2019, at 3:10 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 7, 2019, at 8:49 PM, Taymour Gabr via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
this doesn't answer my question though of how/if checkrad works for simultaneous-use set to anything other than 1.
Checkrad is run once for every user session. But that means it has to check *each* user session.
Also, could you please expand on what you consider to be 'modern' NASes? 2 years-old, 5 years-old, 10?
Realistically, 10 years. Checkrad is ~20 years old, and hasn't been updated in a very long time.
We are looking to replace our crappy HP controller. Unfortunately HP was taken over by Aruba, and their controllers don't support HP Access points. So we are trying to go with the latest HP controller, and I would like to make sure that simultaneous-use will be covered.
At this point, the NASes should work better. Checkrad is less useful.
The majority of installations that use simultaneous use checks, just run a script against the database periodically, looking at the last time an interim was received, and closing out sessions where at least two interims have been missed. I added 'acctupdatetime' to the majority of the default schemas a few years back to encourage more people to do that, over using the old SNMP based methods. For this to work you do need to enable interim updates on the controller (set it to something like 5 mins if your servers can handle it). If you wanted to contribute something useful, I know some databases have cronlike functionality. It'd be good to include a cronlike job to close out stale sessions in the default schemas. Just as an aside - there's also been some internal discussion about creating an rlm_snmp to allow async queries against NAS. If that work gets completed, then we'd likely ditch checkrad in favour of integrated runtime checks. When the I/O is async you don't really care about blocking the request trying to talk to an unreachable NAS, you just need to set appropriate timeouts. -Arran
Very interesting and useful, However, in the case where the accounting table already records multiple sessions for a username seconds after the first person has logged in on a fresh account, this periodic check won't help much. checkrad would solve the problem here (if the controller provides the information), and rlm_snmp sounds like it would as well. For my case, I'm actually suspecting now that this controller might specifically have a tendency to spam sessions when someone logs in, so perhaps removing non-unique sessions might be useful. Regardless, I'll have a proper look at my radacct table before proceeding with checkrad and SNMP. Thanks a lot, Taymour On 08/07/2019, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On Jul 7, 2019, at 3:10 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Jul 7, 2019, at 8:49 PM, Taymour Gabr via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
this doesn't answer my question though of how/if checkrad works for simultaneous-use set to anything other than 1.
Checkrad is run once for every user session. But that means it has to check *each* user session.
Also, could you please expand on what you consider to be 'modern' NASes? 2 years-old, 5 years-old, 10?
Realistically, 10 years. Checkrad is ~20 years old, and hasn't been updated in a very long time.
We are looking to replace our crappy HP controller. Unfortunately HP was taken over by Aruba, and their controllers don't support HP Access points. So we are trying to go with the latest HP controller, and I would like to make sure that simultaneous-use will be covered.
At this point, the NASes should work better. Checkrad is less useful.
The majority of installations that use simultaneous use checks, just run a script against the database periodically, looking at the last time an interim was received, and closing out sessions where at least two interims have been missed. I added 'acctupdatetime' to the majority of the default schemas a few years back to encourage more people to do that, over using the old SNMP based methods. For this to work you do need to enable interim updates on the controller (set it to something like 5 mins if your servers can handle it).
If you wanted to contribute something useful, I know some databases have cronlike functionality. It'd be good to include a cronlike job to close out stale sessions in the default schemas.
Just as an aside - there's also been some internal discussion about creating an rlm_snmp to allow async queries against NAS. If that work gets completed, then we'd likely ditch checkrad in favour of integrated runtime checks. When the I/O is async you don't really care about blocking the request trying to talk to an unreachable NAS, you just need to set appropriate timeouts.
-Arran
On Jul 8, 2019, at 1:55 AM, Taymour Gabr via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Very interesting and useful, However, in the case where the accounting table already records multiple sessions for a username seconds after the first person has logged in on a fresh account, this periodic check won't help much.
Are multiple people actually logging in at the same time? If so, see the recent 3.0 releases. There's code in "queries.conf" which allows you to create accounting records from the post-auth section. Just look for "post-auth" in that file. When that's used, you can update the accounting sessions immediately when a user logs in. Then, if another user tries to log in within a few seconds, you see that a session already exists, and reject the second session.
checkrad would solve the problem here (if the controller provides the information), and rlm_snmp sounds like it would as well.
For my case, I'm actually suspecting now that this controller might specifically have a tendency to spam sessions when someone logs in, so perhaps removing non-unique sessions might be useful.
The correct solution to a broken controller is to fix the controller. In most cases, it's just impossible to fix it on the RADIUS server. Only the controller knows what's actually going on. The RADIUS server only knows what the controller tells it. And if the controller lies, the RADIUS server can't make any correct decision. Alan DeKok.
participants (4)
-
Alan Buxey -
Alan DeKok -
Arran Cudbard-Bell -
Taymour Gabr